Secure Value

Secure Value by Keeping Up with Changes in Social Networking

Image by Jukka Vuokko via Flickr

Security and privacy issues in the social media space are evolving so rapidly it seems impossible to keep up; you need to invest some time to stay informed!

Last May I did a series of public presentations on Social Media.  The Columbus ISACA chapter is co-hosting a session on social media with the local chapter of the IIA called: LinkedWorking: Utilizing Social Media to Advance & Enhance Business.  That session will include a panel discussion on social media which I facilitating.

In reviewing social media through the security and privacy prism these changes have occured in less than a year:

• Twitter lost confidential information stored in GoogleDocs because of poor password discipline
• Bloggers now have disclosure rules based on new regulations from the FTC.
• Facebook has changed its privacy module.
• Twitter has begun to offer Verified Profiles to celebs and VIPs.
• New threats have emerged on the landscape.

What changes do you see in the next 8 months?

State of Ohio Cyber Summit -- February 17, 2010

Image via Wikipedia

The State of Ohio is hosting a Cyber Summit on February 17, 2010.  A session is being held for small business and local government. 

Download CYBER SUMMIT GENERAL_Final

The summit will address the following questions:

• Do you fully understand the risks if you suffer a security lapse?
• Are your employees putting your business at risk?
• Could your brand be tarnished by cyber criminals if they hijacked your system?
• Can good Cyber Security give you a competitive advantage?

I am attending and will blog on the content afterward. 

Should you go?  I can't speak to the content, but I can speak to the importance of knowing the answers to the questions that will be addressed.  Operating without understanding (and managing) the risks facing your business is a recipe for losing value.

Secure Value by Understanding that Cybercrime Increasing Faster than Company Defenses

How are your company's defenses? Don't forget to tend to them as your run and grow your business!

Tonight I read the 2010 CyberSecurity Watch Survey.  "The 2010 CSO CyberSecurity Watch Survey was sponsored by Deloitte and conducted in 2009 in collaboration with CSO Magazine, the U.S. Secret Service, and the CERT Coordination Center at Carnegie Mellon."

The report hit close to home because in the past 30 days we have:

• begun projects with several firms that have had web sites targeted and attacked;
• assisted a firm manage an longstanding employee out of the organization because he had "quit and stayed", taking an offer from a competitor while continuing to "work", explore available confidential information and download it, and;
• developed an incident handling and forensic process for a large Software as a Service (SaaS).

The report is a quick read (16 pages).  I suggest you dive into it and then use it to talk to your HR and IT management to make sure you are properly protected.

Related articles by Zemanta

• 2010 CyberSecurity Watch Survey: Cybercrime Increasing Faster Than Some Company Defenses (eon.businesswire.com)
• Report: Companies unprepared for cybercrime (news.cnet.com)
• Companies unprepared for cybercrime (comsecllc.blogspot.com)

What are your social media security questions?

Image via Wikipedia

Speaking Engagement -- Feedback Appreciated: What are your social media security questions?

I am facilitating a panel discussion on social media at a joint IIA and ISACA breakfast meeting February 9th called LinkedWorking: Utilizing Social Media to Advance & Enhance Business.

We are going to hear some basics on social networking from Frank Agin and then follow that with a panel discussion.  The panel will be a marketing director and two information security professionals. We'll give them 1 to 2 minutes to give a preamble statement and then hit them with canned and crowd questions. 

I need help building my list of precanned questions.  What are your social media security questions?

Please drop your thoughts in the comments.

I'll post a follow up after the meeting.

Topic: LinkedWorking: Utilizing Social Media to Advance & Enhance Business

February Breakfast Meeting Co-Sponsored by IIA and ISACA

Special 2 CPE Presentation
Presented by: Frank Agin of AmSpirit Business Connections
Date: February 9, 2010, 8:00 AM to 10:30 AM

Secure Value by Securing Critical Information

Image by Getty Images via Daylife

I work with business leaders and executives who are nervous their company's critical data might be exposed and who are scared they are not compliant with government rules and regulations.   I find most don’t understand the critical nature of the information security game. 

Most agree that customer trust and financial integrity are critical to their business. 

All agree that the office or store doors and cash box need to be under lock and key. 

Few argue that the lights, phones and computers need to come on when work starts each day. 

But many think information security which is protecting the confidentiality, integrity and availability of their critical information while also address government and sometimes customer obligations is distraction, bother or obstacle. 

Until they have an information loss. 

Entrepreneurs need to identify the value of the information within their business, understand the risks to that information and understand that securing it is not just a computer problem.

Does information security and risk management share equal management attention as process quality, customer satisfaction, and financial integrity?

Related articles by Zemanta

• Getting Company Owners To Follow Their Own Rules? (ask.slashdot.org)

Secure Value by Understanding the Technology Your Business Depends On

Image by dokmarius via Flickr

There's a map for that

I've been enjoying the heat generated by  AT&T (NYSE: T) and Verizon Wireless (NYSE: VZ) conflict that Verizon’s “There’s a map for that” TV ads started.  Verizon compares the two networks 3g coverage areas with a "There's a map for that" response to a number of questions in a series of funny commercials.

AT&T responded with a series of ads featuring actor Luke Wilson.  If you notice Wilson’s folksy attacks on Verizon fail to directly refute the "There's a map for that" attack.  Every time one interrupts a game on tv I want to shout “C’mon, Luke, is the blue map really that weak?!”

Who is right?

Not for me to settle out here.

The VZ v T battle highlights an information security issue for small and emerging business owners and executives.  The tech companies talk to us with cutsey ads instead of facts.  The facts are often highly technical and not a lot of fun to wade through.  And many of us aren’t knowledgeable enough in the ways of the bits and bytes to effectively do the wading.  So we (as in we entrepreneurs, business leaders, business owners and execs) make our decisions as much on emotion and "gut feel" as we do on cold hard facts.

In a situation like picking cell phone service we might just make a gut decision that costs us more or provides us poor services. 

In working with technology this way in our businesses, it means we make decisions without the knowledge of how that decision will affect the confidentiality, integrity and availability of critical information or how that decision will affect your compliance with government regulations.

TIP:  You have your account and your attorney for financial and legal matters.  Find your trusted IT advisor you navigate the technology map.  He doesn’t need to be a specialist in any specific area, but a generalist that can act as a sounding board for when you want to make IT decisions. The right pick will help you be more secure, while also helping you select and use technology more successfully in your business.

Here's to VZ and T both being honest about what 3G is, network quality, coverage areas v. coverage populations and other important facts.

Secure Value through Tabletop Exercises: Three Sample Scenarios - CSO Online - Security and Risk

Image by lumierefl via Flickr

December 01, 2006 — CSO — A tabletop exercise is a great way to get business continuity plans off the written page without the interruption of a full-scale drill. Rather than actually simulating a disaster, the crisis management group gathers for three hours to talk through a simulated disaster.

via www.csoonline.com

We don't spend enough time thinking about disasters ... until they happen .. this is a great article on a technique to put your best brains in thinking through scenarios using a technique called "Tabletop Exercises".

Secure Value by Knowing What Lies Ahead in 2010

Image via Wikipedia

The start of the New Year provides an appropriate time to think about the future predictable challenges that will face us in the months ahead.  In fact, we had a two hour block scheduled today that was to include myself, Jacadis' CTO Simon Herring, Jacadis' VP of Sales Mike Keay and some other key employees.  We were just going to spend the afternoon with a couple pots of coffee, a white board and everyone's perspectives on what 2010 would throw at us and our customers.

Instead, Old Man Winter, threw an afternoon snow storm our way and we decided to get the company home safe and save the brainstorming for another day.  Are you thinking about what you will need to do to secure value in 2010? What are your key information security concerns? What are your key compliance concerns? What are the concerns of your key customers? suppliers?  Do you have plans in place to deal with them?

I'll share the outcome of our meeting ... once we dig out .. but in the meantime I'd love to have your perspectives.

Secure Value by Providing Privacy for Your Customers

Use free DMA tool to build privacy policy -- and then follow it!

The Direct Marketing Association offers a free Privacy Policy Generator.  It is touted as a tool that "Webmasters and administrators can complete a questionnaire (basing their answers on their site information policies) and create a privacy policy statement to be posted on their own Web page."

I suggest you use it a little differently.

Don't simply rely on your webmaster or an administrator to fill the survey in.  Use it as a chance to discuss your online privacy practices.  Do you do what you say you will do?  Real trust can only be built by your being transparent about your practices.  If you are collecting information on customers but don't want to admit to it are you operating in a way that builds consumer trust?

If you are building a new web based business use the survey to guide a discussion with your developer.  Only collect information that you need to serve the customer best.  If you aren't going to use it, don't collect it!

If you have an existing web facility use the survey to guide a discussion of your current practices.  Are you collecting information that isn't used?  Why?  If you aren't using it but collecting it you are either exposing yourself if you aren't properly protecting it or spending money to protect something that you don't need in the first place!

Related articles by Zemanta

• AdSense Advertisers: Change Privacy Policies for GOOG's BA Push (marketingvox.com)
• Ad industry groups agree to privacy guidelines (news.cnet.com)

Secure Value by Keeping an Eye on RedFlags ... some small businesses may be exempt!

Image via Wikipedia

Trying to manage the incoming waves of regulations is bad enough ... but keeping track of what is on and what is not on anymore is a tough job when you really just want to run and grow your business!

Short one this week.  You want to keep an eye on this news.  According to an article in SCmagazine.com there is a bill working its way through Congress that may exempt some small business from the RedFlags rules.

Related articles by Zemanta

• U.S. House Says Most Dental Offices Are Exempt From Red-Flag Rules (implantblog.wordpress.com)